Skip to content

Commit b16ac47

Browse files
ekohlekohl
authored
Merge pull request #228 from ekohl/fix-syntax
Fix syntax in pem_cert.pp and correctly pass in a flat array
2 parents a38c6ad + b62720f commit b16ac47

File tree

5 files changed

+125
-74
lines changed

5 files changed

+125
-74
lines changed

‎lib/puppet/provider/x509_cert/openssl.rb‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -68,14 +68,14 @@ def create
6868
'-out', resource[:path]
6969
]
7070
if resource[:ca]
71-
options << ['-extfile', resource[:template]]
72-
options << ['-CAcreateserial']
73-
options << ['-CA', resource[:ca]]
74-
options << ['-CAkey', resource[:cakey]]
71+
options += ['-extfile', resource[:template]]
72+
options += ['-CAcreateserial']
73+
options += ['-CA', resource[:ca]]
74+
options += ['-CAkey', resource[:cakey]]
7575
else
76-
options << ['-signkey', resource[:private_key]]
76+
options += ['-signkey', resource[:private_key]]
7777
if resource[:req_ext]
78-
options << [
78+
options += [
7979
'-extensions', 'v3_req',
8080
'-extfile', resource[:template]
8181
]
@@ -95,11 +95,14 @@ def create
9595
password = resource[:cakey_password] || resource[:password]
9696

9797
if password
98-
options << ['-passin', 'env:CERTIFICATE_PASSIN']
98+
options += ['-passin', 'env:CERTIFICATE_PASSIN']
9999
env['CERTIFICATE_PASSIN'] = password
100100
end
101-
options << ['-extensions', 'v3_req'] if resource[:req_ext] != :false
102-
openssl options, environment: env
101+
options += ['-extensions', 'v3_req'] if resource[:req_ext] != :false
102+
103+
# openssl(options) doesn't work because it's impossible to pass an env
104+
# https://github.com/puppetlabs/puppet/issues/9493
105+
execute([command('openssl')] + options, { failonfail: true, combine: true, custom_environment: env })
103106
end
104107

105108
def destroy

‎lib/puppet/provider/x509_request/openssl.rb‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,14 @@ def create
3737
]
3838

3939
if resource[:password]
40-
options << ['-passin', 'env:CERTIFICATE_PASSIN']
40+
options += ['-passin', 'env:CERTIFICATE_PASSIN']
4141
env['CERTIFICATE_PASSIN'] = resource[:password]
4242
end
43-
options << ['-nodes'] unless resource[:encrypted]
43+
options << '-nodes' unless resource[:encrypted]
4444

45-
openssl options, environment: env
45+
# openssl(options) doesn't work because it's impossible to pass an env
46+
# https://github.com/puppetlabs/puppet/issues/9493
47+
execute([command('openssl')] + options, { failonfail: true, combine: true, custom_environment: env })
4648
end
4749

4850
def destroy

‎manifests/export/pem_cert.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666

6767
exec { "Export ${in_cert} to ${pem_cert}":
6868
command => $cmd,
69-
environment => $passin_env
69+
environment => $passin_env,
7070
path => $facts['path'],
7171
* => $exec_params,
7272
}

‎spec/unit/puppet/provider/x509_cert/openssl_spec.rb‎

Lines changed: 78 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
require 'pathname'
66
require 'puppet/type/x509_cert'
77

8-
provider_class = Puppet::Type.type(:x509_cert).provider(:openssl)
98
describe 'The openssl provider for the x509_cert type' do
109
let(:path) { '/tmp/foo.crt' }
1110
let(:pathname) { Pathname.new(path) }
@@ -31,33 +30,49 @@
3130
end
3231

3332
it 'creates a certificate with the proper options' do
34-
expect(provider_class).to receive(:openssl).with([
35-
'req',
36-
'-config', '/tmp/foo.cnf',
37-
'-new',
38-
'-x509',
39-
'-days', 3650,
40-
'-key', '/tmp/foo.key',
41-
'-out', '/tmp/foo.crt',
42-
['-extensions', 'v3_req']
43-
])
33+
expect(resource.provider).to receive(:execute).with(
34+
[
35+
'/usr/bin/openssl',
36+
'req',
37+
'-config', '/tmp/foo.cnf',
38+
'-new',
39+
'-x509',
40+
'-days', 3650,
41+
'-key', '/tmp/foo.key',
42+
'-out', '/tmp/foo.crt',
43+
'-extensions', 'v3_req',
44+
],
45+
{
46+
combine: true,
47+
custom_environment: {},
48+
failonfail: true,
49+
}
50+
)
4451
resource.provider.create
4552
end
4653

4754
context 'when using password' do
4855
it 'creates a certificate with the proper options' do
4956
resource[:password] = '2x6${'
50-
expect(provider_class).to receive(:openssl).with([
51-
'req',
52-
'-config', '/tmp/foo.cnf',
53-
'-new',
54-
'-x509',
55-
'-days', 3650,
56-
'-key', '/tmp/foo.key',
57-
'-out', '/tmp/foo.crt',
58-
['-passin', 'pass:2x6${'],
59-
['-extensions', 'v3_req']
60-
])
57+
expect(resource.provider).to receive(:execute).with(
58+
[
59+
'/usr/bin/openssl',
60+
'req',
61+
'-config', '/tmp/foo.cnf',
62+
'-new',
63+
'-x509',
64+
'-days', 3650,
65+
'-key', '/tmp/foo.key',
66+
'-out', '/tmp/foo.crt',
67+
'-passin', 'env:CERTIFICATE_PASSIN',
68+
'-extensions', 'v3_req',
69+
],
70+
{
71+
combine: true,
72+
custom_environment: { 'CERTIFICATE_PASSIN' => '2x6${' },
73+
failonfail: true,
74+
}
75+
)
6176
resource.provider.create
6277
end
6378
end
@@ -68,18 +83,26 @@
6883
resource[:csr] = '/tmp/foo.csr'
6984
resource[:ca] = '/tmp/foo-ca.crt'
7085
resource[:cakey] = '/tmp/foo-ca.key'
71-
expect(provider_class).to receive(:openssl).with([
72-
'x509',
73-
'-req',
74-
'-days', 3650,
75-
'-in', '/tmp/foo.csr',
76-
'-out', '/tmp/foo.crt',
77-
['-extfile', '/tmp/foo.cnf'],
78-
['-CAcreateserial'],
79-
['-CA', '/tmp/foo-ca.crt'],
80-
['-CAkey', '/tmp/foo-ca.key'],
81-
['-extensions', 'v3_req']
82-
])
86+
expect(resource.provider).to receive(:execute).with(
87+
[
88+
'/usr/bin/openssl',
89+
'x509',
90+
'-req',
91+
'-days', 3650,
92+
'-in', '/tmp/foo.csr',
93+
'-out', '/tmp/foo.crt',
94+
'-extfile', '/tmp/foo.cnf',
95+
'-CAcreateserial',
96+
'-CA', '/tmp/foo-ca.crt',
97+
'-CAkey', '/tmp/foo-ca.key',
98+
'-extensions', 'v3_req',
99+
],
100+
{
101+
combine: true,
102+
custom_environment: {},
103+
failonfail: true,
104+
}
105+
)
83106
resource.provider.create
84107
end
85108
end
@@ -90,19 +113,27 @@
90113
resource[:ca] = '/tmp/foo-ca.crt'
91114
resource[:cakey] = '/tmp/foo-ca.key'
92115
resource[:cakey_password] = '5i;6%'
93-
expect(provider_class).to receive(:openssl).with([
94-
'x509',
95-
'-req',
96-
'-days', 3650,
97-
'-in', '/tmp/foo.csr',
98-
'-out', '/tmp/foo.crt',
99-
['-extfile', '/tmp/foo.cnf'],
100-
['-CAcreateserial'],
101-
['-CA', '/tmp/foo-ca.crt'],
102-
['-CAkey', '/tmp/foo-ca.key'],
103-
['-passin', 'pass:5i;6%'],
104-
['-extensions', 'v3_req']
105-
])
116+
expect(resource.provider).to receive(:execute).with(
117+
[
118+
'/usr/bin/openssl',
119+
'x509',
120+
'-req',
121+
'-days', 3650,
122+
'-in', '/tmp/foo.csr',
123+
'-out', '/tmp/foo.crt',
124+
'-extfile', '/tmp/foo.cnf',
125+
'-CAcreateserial',
126+
'-CA', '/tmp/foo-ca.crt',
127+
'-CAkey', '/tmp/foo-ca.key',
128+
'-passin', 'env:CERTIFICATE_PASSIN',
129+
'-extensions', 'v3_req',
130+
],
131+
{
132+
combine: true,
133+
custom_environment: { 'CERTIFICATE_PASSIN' => '5i;6%' },
134+
failonfail: true,
135+
}
136+
)
106137
resource.provider.create
107138
end
108139
end

‎spec/unit/puppet/provider/x509_request/openssl_spec.rb‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
require 'pathname'
55
require 'puppet/type/x509_request'
66

7-
provider_class = Puppet::Type.type(:x509_request).provider(:openssl)
87
describe 'The openssl provider for the x509_request type' do
98
let(:path) { '/tmp/foo.csr' }
109
let(:pathname) { Pathname.new(path) }
@@ -27,26 +26,42 @@
2726
end
2827

2928
it 'creates a certificate with the proper options' do
30-
expect(provider_class).to receive(:openssl).with([
31-
'req', '-new',
32-
'-key', '/tmp/foo.key',
33-
'-config', '/tmp/foo.cnf',
34-
'-out', '/tmp/foo.csr'
35-
])
29+
expect(resource.provider).to receive(:execute).with(
30+
[
31+
'/usr/bin/openssl',
32+
'req', '-new',
33+
'-key', '/tmp/foo.key',
34+
'-config', '/tmp/foo.cnf',
35+
'-out', '/tmp/foo.csr'
36+
],
37+
{
38+
combine: true,
39+
custom_environment: {},
40+
failonfail: true,
41+
}
42+
)
3643
resource.provider.create
3744
end
3845
end
3946

4047
context 'when using password' do
4148
it 'creates a certificate with the proper options' do
4249
resource[:password] = '2x6${'
43-
expect(provider_class).to receive(:openssl).with([
44-
'req', '-new',
45-
'-key', '/tmp/foo.key',
46-
'-config', '/tmp/foo.cnf',
47-
'-out', '/tmp/foo.csr',
48-
['-passin', 'pass:2x6${']
49-
])
50+
expect(resource.provider).to receive(:execute).with(
51+
[
52+
'/usr/bin/openssl',
53+
'req', '-new',
54+
'-key', '/tmp/foo.key',
55+
'-config', '/tmp/foo.cnf',
56+
'-out', '/tmp/foo.csr',
57+
'-passin', 'env:CERTIFICATE_PASSIN',
58+
],
59+
{
60+
combine: true,
61+
custom_environment: { 'CERTIFICATE_PASSIN' => '2x6${' },
62+
failonfail: true,
63+
}
64+
)
5065
resource.provider.create
5166
end
5267
end

0 commit comments

Comments
 (0)